Privacy Policy - Leta Generate Password
Last updated: August 19, 2026

Leta Generate Password is a browser extension for Chrome, Edge, other Chromium-based browsers and Mozilla Firefox-based browsers that gives you one-click popup access to the LetaLab Passwords generator at passwords.letalab.eu.

Summary
This extension does not collect, transmit, sell, or share any personal information, and it does not track you. It embeds the real passwords.letalab.eu page in its popup, using an <iframe>, so what you see and use is that page itself, not a copy or recreation of it. Before showing that frame, the extension sends one small request to passwords.letalab.eu to confirm the site is currently responding, so it can show a plain notice instead of a blank frame if the site happens to be down. Beyond that one check, the extension's own code does not read, modify, or intercept anything that happens inside the frame, once the real page loads there, using it is the same as visiting passwords.letalab.eu directly in a browser tab. The only setting this extension stores is whether it is turned on, and that stays inside your own browser.

What data is stored, and where
The extension stores exactly one value, using the browser's built-in chrome.storage.sync API: whether the extension itself is enabled or disabled. sync is used here, rather than chrome.storage.local, specifically because this one setting has no reason to be tied to a single device, if you turn the extension off on one computer, it stays off if your browser carries settings to another signed-in device. Whether that actually happens, and how, is entirely up to your own browser's sync settings, not this extension.

This storage is provided by the browser itself, not by us. The extension developer never receives, sees, or has access to this data on any server, because no such server exists for this extension. Nothing about what happens inside the embedded page, including any passwords it generates for you, is read, stored, or transmitted by the extension itself.

What the extension accesses, and why
The extension's own code talks to exactly one address, https://passwords.letalab.eu, and only while its own popup is open. It never runs in the background, never polls on a timer, and never contacts anything the moment the browser starts or the extension is installed.

Each time you open the popup (and the extension is turned on), it sends one plain GET request to passwords.letalab.eu to check whether the site is currently responding. That request carries no cookies, no identifying headers, and no data about you, it is used only to read the response status, and the result is used to decide whether to show the frame, never stored. If the check does not get a response within a few seconds, the popup shows a plain notice rather than an empty frame. Once the check succeeds, the extension sets the frame's address to passwords.letalab.eu and the browser loads the real page there directly, the extension does not act as a proxy for that page and cannot see its contents (browsers keep a page and the extension around it separated for exactly this reason). Because that page can generate and display passwords, treat anything shown inside it the same way you would treat a password shown on passwords.letalab.eu in an ordinary browser tab, anyone able to see your screen while the popup is open can see it too.

The frame is also given permission (via the standard allow="clipboard-write" attribute) to use your clipboard, this is what lets the page's own "Copy" buttons work. It only grants writing, not reading, and only to passwords.letalab.eu itself, the extension does not read your clipboard at any point.

Link to letalab.eu
The extension's popup includes a plain link to letalab.eu, which opens in a new browser tab. The link itself carries no tracking script or tracking parameters - clicking it is no different from typing the address yourself. Once you're on that site, or on passwords.letalab.eu, its own privacy practices apply, separately from this extension. The current policy for passwords.letalab.eu is published at passwords.letalab.eu/Privacy_Policy.html.

Third parties
We do not share data with any third party, and we do not collect any data to share. The one connection this extension's own code makes, to passwords.letalab.eu, is not a third party in the sense this section usually means, it is the LetaLab site this extension exists to put in your popup, and it only happens when you act. The extension embeds no analytics, advertising, or tracking scripts of any kind. Everything that runs inside the popup's own chrome (the header, toggle, and notice text) ships inside the extension package, the embedded page itself is loaded directly from passwords.letalab.eu, not copied into the extension.

Permissions
The extension requests the storage permission (to remember whether it is turned on) and a narrow host_permissions entry for https://passwords.letalab.eu/* only, which is what lets the reachability check above read a real response status instead of only whether your device could reach the server at all. Displaying the page in a frame does not itself need any extra permission, that instead depends on passwords.letalab.eu's own Content-Security-Policy explicitly allowing this extension's fixed origin. Nothing else is requested: no tabs permission, no activeTab, no cookies, no scripting, no webRequest, and no broader host access than that one address.

Security
The extension's full source ships inside the package you install, nothing is downloaded or evaluated at runtime beyond the one page it opens on request. We welcome responsible security review, if you find a problem, please report it privately and with enough detail to reproduce it, via the contact below.

Children's privacy
The extension is not directed at children and does not knowingly collect personal information from anyone, regardless of age.

Changes to this policy
If this extension's data practices ever change, this page will be updated before the change takes effect, and the "Last updated" date above will be revised accordingly.

Contact
Questions about this policy, the extension, or a security report can be sent via letalab.eu.